diff options
author | H. Peter Anvin <hpa@zytor.com> | 2012-03-02 13:43:48 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-03-02 14:38:15 -0500 |
commit | c8e252586f8d5de906385d8cf6385fee289a825e (patch) | |
tree | 11bf3ac4f0d0b3961fcf1c98ee5cd1824ebd5614 /include | |
parent | 1f033c1a6ec1a6815e9c4507d83eb20161163c37 (diff) |
regset: Prevent null pointer reference on readonly regsets
The regset common infrastructure assumed that regsets would always
have .get and .set methods, but not necessarily .active methods.
Unfortunately people have since written regsets without .set methods.
Rather than putting in stub functions everywhere, handle regsets with
null .get or .set methods explicitly.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Roland McGrath <roland@hack.frob.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include')
-rw-r--r-- | include/linux/regset.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/include/linux/regset.h b/include/linux/regset.h index 8abee6556223..5150fd16ef93 100644 --- a/include/linux/regset.h +++ b/include/linux/regset.h | |||
@@ -335,6 +335,9 @@ static inline int copy_regset_to_user(struct task_struct *target, | |||
335 | { | 335 | { |
336 | const struct user_regset *regset = &view->regsets[setno]; | 336 | const struct user_regset *regset = &view->regsets[setno]; |
337 | 337 | ||
338 | if (!regset->get) | ||
339 | return -EOPNOTSUPP; | ||
340 | |||
338 | if (!access_ok(VERIFY_WRITE, data, size)) | 341 | if (!access_ok(VERIFY_WRITE, data, size)) |
339 | return -EIO; | 342 | return -EIO; |
340 | 343 | ||
@@ -358,6 +361,9 @@ static inline int copy_regset_from_user(struct task_struct *target, | |||
358 | { | 361 | { |
359 | const struct user_regset *regset = &view->regsets[setno]; | 362 | const struct user_regset *regset = &view->regsets[setno]; |
360 | 363 | ||
364 | if (!regset->set) | ||
365 | return -EOPNOTSUPP; | ||
366 | |||
361 | if (!access_ok(VERIFY_READ, data, size)) | 367 | if (!access_ok(VERIFY_READ, data, size)) |
362 | return -EIO; | 368 | return -EIO; |
363 | 369 | ||